CVE-2024-21733
published 2024-01-19CVE-2024-21733: Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from…
PriorityP334medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
14.29%
96.2th percentile
Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected.
Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | >= 8.5.7 < 8.5.64 | 8.5.64 |
| apache | tomcat | >= 9.0.1 < 9.0.44 | 9.0.44 |
| apache_software_foundation | apache_tomcat | 8.5.7 – 8.5.63 | — |
| apache_software_foundation | apache_tomcat | 9.0.0-M11 – 9.0.43 | — |
| debian | tomcat9 | < tomcat9 9.0.53-1 (bookworm) | tomcat9 9.0.53-1 (bookworm) |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2024-21733 is a Client-Side Desync (CSD) / partial POST request smuggling vulnerability. Trigger condition: send a POST request with Content-Length: 6 but a body shorter than declared (e.g., a single byte 'X'). The server's error response for the incomplete request leaks body data from a prior user's request. ↗
- →The vulnerability manifests as an HTTP 400 Bad Request error response that embeds data from a previous request in the 'Invalid character found in method name' error message — monitor for 400 responses from Tomcat whose body contains URL-encoded POST parameters from unrelated requests. ↗
- →Incomplete POST requests triggered an error response that could contain data from a previous request from another user — detect by correlating POST requests with a declared Content-Length that exceeds the actual body bytes sent on a keep-alive connection. ↗
- →Affected versions are Apache Tomcat 8.5.7–8.5.63 and 9.0.0-M11–9.0.43. Identify vulnerable servers via the version string disclosed in 404 error pages (default Tomcat error pages expose the version). Presence of these versions on internet-facing hosts should be treated as high-priority patching. ↗
- →The exploit requires Connection: keep-alive and a mismatched Content-Length. Detection rule: flag HTTP POST requests where the Connection header is keep-alive, Content-Length is declared, and the actual body length is less than the declared value — especially when followed immediately by a 400 response on the same TCP connection. ↗
- →The original vulnerability reporter is xer0dayz from Sn1perSecurity LLC; the canonical PoC is documented in HackerOne report #2327341. Threat intel pivot: monitor for tooling or scripts referencing this report ID. ↗
- ·The vulnerability only affects Apache Tomcat 8.5.7–8.5.63 and 9.0.0-M11–9.0.43. Red Hat Enterprise Linux ships unaffected versions and is not impacted. ↗
- ·Some public GitHub PoCs for this CVE are less reliable than the HackerOne report #2327341 payload; defenders should validate detection logic against the canonical payload rather than unreliable PoC variants. ↗
- ·The JSESSIONID cookie value found in victim.sh (EFC6BC3B39449C34A07AAEED1E9BE69A) is specific to the CTF challenge simulation and is NOT a real-world IOC; it was part of a poorly written simulation script acknowledged by the challenge author. ↗
- ·The keystore password 'yoyoma' and selfsigned.jks file are CTF-specific artifacts and not relevant to real-world exploitation of CVE-2024-21733. ↗
- ·Although CVSS scores this at 5.3 (Medium), the vulnerability can lead to authentication bypass by leaking credentials from other users' requests in a shared/multi-user environment. ↗
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
osv5.3MEDIUM
vendor_apache5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
tomcat vulnerabilities
osv·2025-06-09·CVSS 4.3
CVE-2023-28708 [MEDIUM] tomcat vulnerabilities
tomcat vulnerabilities
It was discovered that Tomcat did not include the secure attribute for
session cookies when using the RemoteIpFilter with requests from a reverse
proxy. An attacker could possibly use this issue to leak sensitive
information. This issue was fixed for tomcat8 on Ubuntu 18.04 LTS and for
tomcat9 on Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04.
(CVE-2023-28708)
It was discovered that Tomcat incorrectly recycled
certain objects, which could lead to information leaking from one request
to the next. An attacker could potentially use this issue to leak sensitive
information. This issue was fixed for tomcat8 on Ubuntu 18.04 LTS and for
tomcat9 on Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04.
(CVE-2023-42795)
It was discovered that Tomcat incorrectly handled HTTP
t
OSV
CVE-2024-21733: Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat
osv·2024-01-19·CVSS 5.3
CVE-2024-21733 [MEDIUM] CVE-2024-21733: Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat
Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.
OSV
Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information
osv·2024-01-19
CVE-2024-21733 [MEDIUM] Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information
Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information
Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43.
Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.
GHSA
Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information
ghsa·2024-01-19
CVE-2024-21733 [MEDIUM] CWE-209 Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information
Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information
Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43.
Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2025-06-09·CVSS 4.3
CVE-2024-34750 [MEDIUM] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in tomcat8, tomcat9, tomcat10.
It was discovered that Tomcat did not include the secure attribute for
session cookies when using the RemoteIpFilter with requests from a reverse
proxy. An attacker could possibly use this issue to leak sensitive
information. This issue was fixed for tomcat8 on Ubuntu 18.04 LTS and for
tomcat9 on Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04.
(CVE-2023-28708)
It was discovered that Tomcat incorrectly recycled
certain objects, which could lead to information leaking from one request
to the next. An attacker could potentially use this issue to leak sensitive
information. This issue was fixed for tomcat8 on Ubuntu 18.04 LTS and for
tomcat9 on Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubunt
Red Hat
tomcat: Leaking of unrelated request bodies in default error page
vendor_redhat·2024-01-19·CVSS 5.3
CVE-2024-21733 [MEDIUM] CWE-209 tomcat: Leaking of unrelated request bodies in default error page
tomcat: Leaking of unrelated request bodies in default error page
Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected.
Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.
An information disclosure vulnerability was found in Apache Tomcat. Incomplete POST requests triggered an error response that could contain data from a previous HTTP request. This flaw allows a remote attacker to access files from another user that should be otherwise prevented by limits or authentication.
Statement: Red Hat Enterprise Linux remains unaffected as the vulnerable version of
Debian
CVE-2024-21733: tomcat9 - Generation of Error Message Containing Sensitive Information vulnerability in Ap...
vendor_debian·2024·CVSS 5.3
CVE-2024-21733 [MEDIUM] CVE-2024-21733: tomcat9 - Generation of Error Message Containing Sensitive Information vulnerability in Ap...
Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.
Scope: local
bookworm: resolved (fixed in 9.0.53-1)
bullseye: resolved (fixed in 9.0.43-2~deb11u11)
forky: resolved (fixed in 9.0.53-1)
sid: resolved (fixed in 9.0.53-1)
trixie: resolved (fixed in 9.0.53-1)
Apache
Apache tomcat: CVE-2024-21733
vendor_apache·CVSS 5.3
CVE-2024-21733 [MEDIUM] Apache tomcat: CVE-2024-21733
Apache tomcat: CVE-2024-21733
Incomplete POST requests triggered an error response that could contain data from a previous request from another user. This was fixed with commit ce4b154e . This issue was reported to the Apache Tomcat Security Team by xer0dayz from Sn1perSecurity LLC on 20 December 2023. The issue was made public on 19 January 2024. Affects: 8.5.7 to 8.5.63 2 February 2021 Fixed in Apache Tomcat 8.5.63 Note: The issues below were fixed in Apache Tomcat 8.5.62 but the release vote for the 8.5.62 release candidate did not pass. Therefore, although users must download 8.5.63 to obtain a version that includes a fix for these issues, version 8.5.62 is not included in the list of affected versions. Low: Fix for
No detection rules found.
No public exploits indexed.
HackerOne
CVE-2024-21733 Apache Tomcat HTTP Request Smuggling (Client- Side Desync) (CWE: 444)
hackerone·2024-01-29·CVSS 5.3
CVE-2024-21733 [MEDIUM] CVE-2024-21733 Apache Tomcat HTTP Request Smuggling (Client- Side Desync) (CWE: 444)
CVE-2024-21733 Apache Tomcat HTTP Request Smuggling (Client- Side Desync) (CWE: 444)
Apache Tomcat from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43 are vulnerable to client-side de-sync attacks.
Client-side de-sync (CSD) vulnerabilities occur when a web server fails to correctly process the Content-Length of POST requests. By exploiting this behavior, an attacker can force a victim's browser to de-synchronize its connection with the website, causing sensitive data to be smuggled from the server and/or client connections.
Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.
PoC:
~~~~~~~~~~~~~~~~~~
POST / HTTP/1.1
Host: hostname
Sec-Ch-Ua: "Chromium";v="119", "Not?A_Brand";v="24"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform:
Bugzilla
CVE-2024-21733 tomcat: Leaking of unrelated request bodies in default error page
bugzilla·2024-01-19·CVSS 5.3
CVE-2024-21733 [MEDIUM] CVE-2024-21733 tomcat: Leaking of unrelated request bodies in default error page
CVE-2024-21733 tomcat: Leaking of unrelated request bodies in default error page
Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.
References:
http://www.openwall.com/lists/oss-security/2024/01/19/2
https://lists.apache.org/thread/h9bjqdd0odj6lhs2o96qgowcc6hb0cfz
Discussion:
Tomcat security advisories:
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.44
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.64
Upstream fix:
https://github.com/apache/tomcat/commit/86ccc43940861703c2be96a5f35384407522125a [9.0
arXiv
VulRG: Multi-Level Explainable Vulnerability Patch Ranking for Complex Systems Using Graphs
arxiv_fulltext·2025-02-16
VulRG: Multi-Level Explainable Vulnerability Patch Ranking for Complex Systems Using Graphs
VulRG: Multi-Level Explainable Vulnerability Patch Ranking for Complex Systems Using Graphs
Yuning Jiang
[email protected]
0000-0003-4791-8452
National University of Singapore
Singapore
Nay Oo
[email protected]
NCS Cyber Special Ops R&D
Singapore
Qiaoran Meng
[email protected]
National University of Singapore
Singapore
Hoon Wei Lim
[email protected]
NCS Cyber Special Ops R&D
Singapore
Biplab Sikdar
[email protected]
National University of Singapore
Singapore
Jiang et al.
## Abstract
As interconnected systems proliferate, safeguarding complex infrastructures against an escalating array of cyber threats has become an urgent challenge. The growing number of vulnerabilities, coupled with resource constraints, makes addressing every vulnerability impractical, thereby rende
CTF
EPT / README
ctf_writeups·2024
EPT / README
# Blood In Blood Out
Author: LOLASL
Flag: `EPT{vatos_locos_4_ever_ese!_<3}`
## Description
```
Hey carnal, sometimes you gotta slide in a little extra something for the homies.
Theres a placa looking every minute so keep it tight, ese.
*Access the challenge on https://challengevm*
```
## Provided challenge files
* [bloodinbloodout_source.tar.gz](../bloodinbloodout_source.tar.gz)
## Notes from the creator
The inspiration for creating the challenge came from [this tweet](https://twitter.com/pyn3rd/status/1824101455969788274) and the resemblance with [the HeartBleed bug](https://heartbleed.com/) was the background for coming up with the "Blood In Blood Out"-theme. I realize that the provided source code might have caused more harm than good with some poorly written scripts that simulated
CTF
SIFI / README
ctf_writeups·2024·CVSS 5.3
CVE-2024-21733 [MEDIUM] SIFI / README
# TASK INFO
Task Author: LOLASL
Writeup author: Raresh1t (SIFI)
CVE exploited: Sensitive Information leak in Apache Tomcat available through version 9.0.43
CVE-2024-21733
**Task text:**
*Hey carnal, sometimes you gotta slide in a little extra something for the homies. Theres a placa looking every minute so keep it tight, ese.*
The task theme is based on the movie "Blood In Blood Out" released in 1993, focusing on the Vatos Locos gang in Los Angeles in 1970s California.
# File analysis
**Attached file:**
A gzip archive is attached with the task. (bloodinbloodout.tar.gz)
Unzipping this archive extracts a folder named "source" which contains 5 files and 1 other directory.
**Dockerfile:** Contains the docker instancing instructions. Exposes port 8443. Finishes by running run.sh
**run
https://lists.apache.org/thread/h9bjqdd0odj6lhs2o96qgowcc6hb0cfzhttp://packetstormsecurity.com/files/176951/Apache-Tomcat-8.5.63-9.0.43-HTTP-Response-Smuggling.htmlhttp://www.openwall.com/lists/oss-security/2024/01/19/2https://lists.apache.org/thread/h9bjqdd0odj6lhs2o96qgowcc6hb0cfzhttps://lists.debian.org/debian-lts-announce/2025/01/msg00009.htmlhttps://security.netapp.com/advisory/ntap-20240216-0005/
2024-01-19
Published